---
id: CVE-2026-111693
title: DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials
summary: >-
  DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials
  vulnerability that allows unauthenticated attackers to gain administrator
  access using the built-in admin/Databuff@123 account. Attackers can POST these
  credent…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-1392
vendor: databufflabs
product: databuff
affected:
  - databuff <= 0.1.10
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T17:39:48.920Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111693'
references:
  - url: 'https://hackmd.io/@hieuPenguinnn/databuff-default-jwt-secret-auth-bypass'
  - url: >-
      https://github.com/databufflabs/databuff/blob/v0.1.10/ai-apm-web/src/main/java/com/databuff/apm/web/admin/account/PortalUserManagementService.java#L14-L31
  - url: 'https://github.com/databufflabs/databuff'
  - url: >-
      https://www.vulncheck.com/advisories/databuff-ai-apm-web-through-0.1.10-hard-coded-default-admin-credentials
    label: >-
      VulnCheck Advisory: DataBuff ai-apm-web through 0.1.10 Hard-Coded Default
      Admin Credentials
tags:
  - cve.org
ingestedAt: '2026-10-16T18:43:08.656Z'
epss: 0.00378
epssPercentile: 0.30171
---

## Overview

DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator token and access all protected /webapi routes.

## Affected

- `databuff <= 0.1.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.